The Pentagon Knew Enemies Could Track Troops’ Phones for Years. Now They Are

For astir a decade, the Pentagon was warned—by its ain contractors, analysts, and quality agencies—that anyone with a recognition paper could bargain a representation of wherever American troops sleep, work, and store atomic weapons. Now the measure has travel owed successful a warfare zone.

A newly disclosed letter shows the warnings went unheeded: US Central Command present confirms it has received “multiple menace reports concerning adversary exploitation of commercialized determination information to people oregon surveil US unit successful theater”—the archetypal authoritative acknowledgment that the data-broker system is being utilized to hunt American forces successful the Middle East.

The targeting was first reported by Reuters, which obtained the Centcom letter. But the confirmation lands atop a grounds that is longer and much damning than the azygous papers suggests.

For the amended portion of a decade, US lawmakers person heard the aforesaid alarms astir the dangers of commercially disposable determination information that the Pentagon did—from the aforesaid quality assessments, from witnesses, from their ain colleagues. Yet broad privateness authorities has repeatedly stalled successful Washington, and the 1 constrictive hole that did pass—a request that information shared with subject contractors not beryllium resold—left the broader manufacture untouched.

One of the earliest warnings came successful 2016. At the Joint Special Operations Command compound astatine Fort Bragg, California, a authorities technologist briefing elder officers demonstrated however commercialized determination data—bought, not hacked—could way phones from Fort Bragg and MacDill Air Force Base successful Florida, the location stations of America's astir elite units, done Turkey and into bluish Syria, wherever they clustered astatine a covert guardant operating base. The aforesaid information was disposable to immoderate advertiser oregon overseas quality service.

Even arsenic the Pentagon was warned that the location-data marketplace was placing its ain radical successful danger, parts of the section were anxious to go its customers. The Defense Intelligence Agency disclosed to Congress successful 2021 that it uses commercially purchased telephone determination data—including connected Americans—without a warrant, taking the presumption that nary is required. Months earlier, Motherboard reported that the US subject was buying determination information harvested from fashionable user apps.

In 2023, the Army paid to person the menace spelled out. Researchers astatine Duke University—working nether a assistance from the US Military Academy astatine West Point—set retired to bargain information connected American work members the mode a overseas adversary might. They scraped hundreds of information broker websites and recovered thousands of listings advertizing information connected subject personnel, including datasets titled “Military Families Mailing List” and “Hard Core Military Families.”

The researchers started buying. For arsenic small arsenic 12 cents a record, with astir nary vetting, they purchased names, location addresses, wellness conditions, and fiscal details connected active-duty troops. Posing arsenic a purchaser operating done a Singapore-based domain, they besides obtained the aforesaid benignant of information geofenced to Fort Bragg, Quantico, and different installations. One broker offered to skip its individuality cheque if they paid by wire.

A twelvemonth later, WIRED found the aforesaid benignant of information flowing done Google's ain advertizing platform. Working with information obtained by the Irish Council for Civil Liberties—whose researcher had gained entree to a US broker’s assemblage lists by lasting up a fake analytics firm—WIRED identified selling “segments” connected Google's Display & Video 360 that singled retired US authorities employees deemed “decisionmakers” moving “specifically successful the tract of nationalist security,” alongside lists targeting radical who enactment for companies licensed to physique missiles, space-launch vehicles, and the cryptographic systems that support classified data.

The Irish Council for Civil Liberties researcher said helium expected to person his screen communicative tested. “When I signed up, determination was nary questions asked whatsoever,” helium told WIRED astatine the time. “I could person been anybody.”